ci: release gate — venue on v1.8.0 then current, hook tests without jq; publish depends on both (GIT-83)

[nTEG-dev]

What

A release gate in ci.yml: publish now depends on the venue driver passing against the v1.8.0 schema and then the current one, and on the hook tests passing on a runner without jq (GIT-83, GIT-112).

• venue-gate (v* tags, plus workflow_dispatch so you can run it before tagging):

  1. git show v1.8.0:schema/setup.sql → scripts/venue-schema.sh reset-to puts the disposable venue on exactly the customer floor.
  2. Driver: flow, then egress --rows 250 --usage 5, then projects when the driver has that mode (it arrives with fix: never resume a session of another project (GIT-86) #37).
  3. scripts/venue-schema.sh apply schema/setup.sql twice: the current schema must apply on top of v1.8.0, and be re-applicable.
  4. Driver flow again on the current schema.
  5. Driver reports are uploaded as an artifact. Netlogs hold method, path, status and size only; no bodies or headers.

  Missing secrets fail the job, because a skipped gate would let publish through. A concurrency: gitmem-venue group stops two runs from wiping each other's venue data.

• scripts/venue-schema.sh: reset-to / apply via psql, --single-transaction, ON_ERROR_STOP, and a PostgREST schema reload at commit. Before connecting, it refuses production (cjptxyezuxdiinufgrrm), by ref and by URL, and any DB URL that doesn't name VENUE_REF. --dry-run prints the plan.

• tests/e2e/venue/reset-gitmem-objects.sql: drops only the objects setup.sql creates.

• hooks-without-jq runs on every CI run, not just tags, since it's cheap and it's the regression that went unnoticed. It runs hooks/tests/test-hooks.sh in node:20-bookworm-slim and first asserts that neither jq nor ps is installed.

• publish: needs: [build, hooks-without-jq, venue-gate].

⚠️ Before this can pass: secrets and merge order

1. Repository secrets for the venue (a human has to add them; no agent can):
   • VENUE_REF = vujndhcumgroztfkkdus
   • VENUE_SUPABASE_URL = https://vujndhcumgroztfkkdus.supabase.co
   • VENUE_SERVICE_ROLE_KEY
   • VENUE_DB_URL: the venue's session-pooler postgresql://postgres.vujndhcumgroztfkkdus:<db password>@aws-0-us-east-1.pooler.supabase.com:5432/postgres
2. Merge fix: hooks resolve .gitmem like the server; session_close names the payload path (GIT-99) #39 (GIT-99/GIT-112) before or with this PR. Without it, hooks-without-jq is red on every PR: on main the Stop hook fails 3 tests without jq. That's the bug this job exists to catch.

How to test

The venue step sequence, run locally against the venue with a main build (as the first tag would). The only difference: the schema steps used supabase db push with the same SQL files, because psql and the DB password aren't available here.

venue on v1.8.0 (reset + v1.8.0 setup.sql) ........ applied
driver flow ................................................ exit 0
driver egress --rows 250 --usage 5 ......................... exit 0
current setup.sql, applied twice ........................... applied
driver flow (current schema) ............................... exit 0
venue restored to v1.8.0 ................................... applied

Not run end to end: the psql transport inside venue-schema.sh, and the workflow on GitHub itself. Run it once with Actions → CI → Run workflow after adding the secrets.

venue-schema.sh guards (--dry-run): venue OK → exit 0; production ref → refused (2); production in the URL with the venue ref elsewhere in it → refused; URL not naming the venue → refused; no URL → refused.

hooks-without-jq, emulated locally. A PATH of symlinks to every system tool except jq and ps, under env -i:

Hook suite from	Result
origin/main	29/32: the three Stop-hook tests fail (GIT-112)
#39 before its ps fix (f1a1842)	42/44: live-session checks fail (every pid looked dead without ps)
#39 now (c18e82a)	46/46

So the job catches both GIT-112 and the ps variant that building it uncovered, which #39 now fixes.

Also caught while testing: my first version detected the projects mode with grep '"projects"'. That matches a .claude/projects path already in main's driver, so the gate would have run a mode main doesn't have and failed. It now matches the usage string flow|egress|projects, verified: main → no-projects, #37 → has-projects.

YAML parses; job graph build, hooks-without-jq, venue-gate → publish. There's no actionlint here.

Item text

The ticket text I received ended at "publish depends on". I read it as "publish depends on this gate". Say if you meant something else.

Checklist

• Gate sequence verified on the venue (v1.8.0 → current), venue left on v1.8.0
• jq-less / ps-less hook run emulated; catches GIT-112
• Workflow run on GitHub: needs the secrets above
• No schema change; no production access (refused twice over)

🤖 Generated with Claude Code